A machine may be configured to interact with a user by verifying that the user is permitted to access something, such as the machine itself, a feature thereof, or a software application thereon, and then granting such permission or notifying the user that such permission has been granted. For example, the machine may present a login interface in the form of a graphical user interface configured to accept login credentials (e.g., a username and a password) entered by a user, submit the login credentials for local or remote verification, receive results of that verification, and present an indication of whether the login credentials are sufficient to grant the user access to something (e.g., a feature, an application, or some data) that corresponds to the login interface.
As used herein, “verification” of a user refers to a determination that the user is indeed who he or she purports to be, which elsewhere could be described as identifying the user, authenticating the user, or logging-in the user. In situations where a first machine uses a trusted second machine to verify the user, the first machine may send the user's login credentials in a request to verify the user, also called a “verification request” herein, to the trusted second machine. However, since some circumstances can be vulnerable to a falsified verification request (e.g., by someone attempting unauthorized access by submitting legitimate login credentials that belong to someone else), it can be helpful to authenticate the verification request itself (e.g., as a separate and independent operation from the verifying of the user). Accordingly, as used herein, “authentication” of a request for verification refers to a determination that the request is legitimate and not falsified.